1. Field of the Invention
This invention describes a new Central Processing Unit (CPU) architecture that allows camouflaging of the encryption program running in an on-chip cryptographic system or smart card. Using this architecture can resist reverse engineering through Power Analysis or Differential Power Analysis (DPA). This CPU architecture may be conveniently used with RISC (Reduced Instruction Set Computer) CPUs.
2. Description of Related Art
Cryptographic techniques are well-known in the art. Indeed, they date from at least the time Caesar when the need to keep certain information secret from prying eyes became important enough for people to find ways to disguise the information by means of codes and ciphers.
Today, cryptographic techniques are in a wide array of applications, both governmental and private. One application of cryptographic techniques is to protect information stored in a Smart Card and/or to protect the capabilities of the Smart Card from unauthorized use or modifications. Cryptographic devices, such as Smart Cards, use secret keys to process input information and/or to produce output information. It has been assumed the information stored in a cryptographic device, such as a Smart Card, was relatively safe from attack provided that an especially strong cryptographic technique is utilized.
Modern cryptography utilizes transposition and substitution of digital data. Messages to be encrypted, known as plaintext, are transformed by a function that is parameterized by a key. The output of the encryption process, known as the ciphertext, is then transmitted. The received ciphertext is then decrypted using a key, back into plaintext.
One example where modern cryptography is used is in pay-TV conditional-access systems such as pay channels for cable and satellite television. Smart cards and/or security processors (containing secret keys) are used to decrypt the television signals. Attackers buy a cable or satellite receiver and then attack the smart card or security processor inside in order to determine the secret keys. The cipher text is the information sent from the cable or satellite provider, and the plaintext is the decrypted television signal set to the television. Thus, it is generally assumed that the input and output information, i.e. the plaintext and ciphertext, is available to attackers, and information about the secret keys is unavailable. FIG. 1 depicts a cryptographic system. An attacker may attack the smart card or security processor by looking for information related to the secret keys that may be leaked via EM radiation, power consumption, timing etc. The leaked information, commonly referred to as side channel information, can then be used by attackers in order to determine the secret key used. One common technique for determining a secret key from leaked or side channel information is known as Differential Power Analysis (DPA). Unfortunately, there is no way to guarantee that power consumption, EM radiation, etc. will not leak certain cryptographic process information being performed by a device and thus obtain information about the secret keys. Therefore, there is a need defensive techniques that result in leaked information that is un-usable by hackers using correlation techniques such as DPA.
The following background discussion is provided in order to supply a context for one application of the presently disclosed technology, which involves a well-known cipher, the data encryption standard (DES), for which DPA analysis is commonly used to break. One skilled in the art will appreciate that this discussion is for illustration purposes only, and that the present invention may be utilized to protect secret keys of a number of data encryption formats from a number of hacking techniques in which side channel information is used in order to determine the secret keys.
The well-known DES cipher utilizes a number, typically 16, of substitution box (S-Box) functions. The S-Box functions are non-linear and can be implemented by using table lookups, Boolean logic or appropriately programmed computers.
It has been discovered within the past several years that DPA can be utilized by attackers to determine the secret keys used in cryptographic devices employing DES such as Smart Cards. See, for example, Differential Power Analysis published by Paul Coker, et al., Cryptographic Research of San Francisco, Calif. A tutorial on Differential Power Analysis is provided in the article, Power Analysis Tutorial, published by Manfred Aigner, et al., of the Institute for Applied Information Processing and Communication, University of Technology, Graz, Austria. In order to utilize the Differential Power Analysis technique, the attacker monitors the power consumption of the cryptographic device. The fluctuations in the power used by the device reflect the operations going on within the device and that, in turn, can be used to glean information about the secret keys stored within the device. While the results have been particularly effective and reported therein with respect to DES and its derivatives, DPA can be used, and has been used, to break other known encryption algorithms.
The cryptographic device can leak other information to the outside world other than just the information which can be gleaned by its power consumption. For example, electromagnetic (EM) radiation can leak information and faulty outputs might show information. Unfortunately, there is no way to guarantee that power consumption, EM radiation, and the like, will not leak certain information, and it is believed that it is impractical to expect cryptographic devices, such as Smart Cards, to be completely leak-free in terms of information being able to be discerned by their power consumption, EM radiation or the like. However, defensive techniques can be used to help ensure that whatever information is leaked cannot be correlated, even if sophisticated statistical approaches are used, for example, in the DPA process. As such, the presently disclosed technology is concerned with making power consumption information difficult to correlate and thus recover the secret keys stored within a cryptographic device, such as a Smart Card.
In the prior art, certain de-correlation techniques do exist. See, for example, U.S. Pat. Nos. 6,295,606 and 6,298,153 to Messerges, et al., and published European Patent Application Number 1,098,469 of Boeckeler. However, these approaches have certain limitations and therefore need improvement. This invention proposes a unique Random Instruction Mask (RIM) as a countermeasure to the DPA process, effectively making power consumption un-correlatable to cipher bit values. The present invention has the following advantages over the techniques of Messerges, Boeckler and others:
(1) More Efficient Calculations: The techniques taught by Messerges et al., slow down the DES algorithm by 300 to 500% due to the regular update of the S-boxes. In the present invention, the DES algorithm will be slowed down by approximately 15%.
(2) More Robust: Even in the presence of leaked information for multiple address locations.
(3) Better Protection: 48-bits of a key can be completely concealed in the last DES round, and
(4) Low Power Consumption: There is an increase in power consumption by less than 1% compared to Boeckeler's random current profiling, which increases power consumption to about 200% during cryptographic operations.
The technique for hindering the correlation of side channel data discussed in Boeckler's European Patent Application Number 1,098,469 superimposes a random current profile, based on a secondary clock CLK2, inserted upon the existing CPU profile which is based on a master clock CLK1. Each clock is randomly adjusted in a range between 3-7 MHz. Due to two clocks differing from one another with respect to their center frequencies, the combined current profile is randomized which makes a DPA attacker's job more difficult.
Messerges' U.S. Pat. No. 6,208,135 uses a randomized starting point in the set of target bits so that the various target bits are processed in a randomly different order. This makes it difficult for a DPA attacker to group related target bits from all the plaintexts of interest in order to perform statistical analyses associated with given target bit positions. However, not only does this approach not conceal the information leaked by a data bus; it also cannot prevent a malicious attacker from using this information to reorder the target bit into the correct bit position.
Messerges also developed another technique. See U.S. Pat. No. 6,295,606. This technique uses a random mask to keep the message and key hidden both while they are stored in memory, and during processing by the cryptographic algorithm itself. However, since the mask is randomly changed, new S-boxes must be updated accordingly, and this takes time slowing down the DES algorithm by a factor of three to five. In addition, this kind of masking operation cannot prevent an attacker from gathering a 48-bit partial key from Round Sixteen when the results must be eventually unmasked to provide the correct cipher output. Thus, Messerges' approach becomes vulnerable to DPA after unmasking. With 48 bits now known at Round Sixteen, the remaining six key bits to make 56 can then be exhaustively searched by an attacker. The present approach described herein is computationally faster, and it also can prevent an attacker from gathering the partial key from Round Sixteen of the DES algorithm.
Before discussion of the details of the invention, additional details related to the DES algorithm and DPA attacks are discussed. If the reader is new to this area, further information regarding this topic may be found in our related U.S. patent application Ser. No. 10/864,556 for an intuitive description of how a DPA attack works and in the following articles, P. Kocher, J. Jaffe, and B. Jun, “Introduction to Differential Power Analysis and Related Attacks”, 1998, Thomas S. Messergers, Ezzy A. Dabbish, and Robert H. Sloan, “Investigations of Power Analysis Attacks on Smartcards”, in Proceedings of USENIX Workshop on Smartcard Technology, Chicago, Ill., May 1999, pp. 151-161, and Manfred Aigner and Elisabeth Oswald, “Power Analysis Tutorial” Institute for Applied Information Processing and Communication University of Technology Graz, Austria. The following discussion provides a context for a detailed explanation of the present invention.
The DES algorithm is an example of an iterative-block cipher. DES is described in detail in ANSI X.392, “American National Standard for Data Encryption Algorithm (DEA)”, American Standards institute, 1981, which is incorporated by reference herein. Substitution/permutation box (SP box) functions comprise one of the major components of the DES round function. The SP box functions are non-linear and are conventionally implemented using lookup tables or Boolean logic gates. In each of the sixteen rounds, the DES encryption algorithm performs eight SP box operations, in turn, by accessing sequentially each lookup table (or by using equivalent logic gates). The eight SP boxes each take, as input, a scrambled 6-bit key, (here scrambled means that the key has been XOR-ed and shifted) and produce a 4-bit output target to be accessed by the CPU for OR-ing operations. Each such 6-bit scrambled key is an SP box's entry address. Each SP lookup contains 64 elements. Each element in a nominal DES implementation is 32-bits and embeds a given 4-bit output target. This embedding is described in U.S. patent application Ser. No. 10/864,569 in detail.
Once the relationship between the 4-bit output target and its corresponding SP box's entry is established, then the calculation of a given SP box's entry address is done. In general, a DES algorithm uses shifting instructions running in the CPU to calculate the box's entry address. Both the number of shifting instructions used in a specific SP box's entry address calculation and the time interval between each consecutive access of an SP box will be well known to anyone who is familiar with the DES algorithm. Given this fact, DPA attacks are focused on aligning the power traces of each 4-bit output target of an SP box by referencing the preceding shifting instruction signature unique to that box.
The DPA approach requires finding patterns in the power traces that are indicative of the logic operations being utilized during DES cryptographic work. These are specific to a given SP box, but given that the DES algorithm is so well known, the kind of operations unique to each SP box is also well known. Take as an example SP box 5 (SP5). In order to determine the address calculation for SP5, the attacker looks for a pattern in the power trace that indicates eight shifts. In addition, the DPA attacker knows that the time from the beginning of the eight shifts to the beginning of a next set of shifts is equal to a time TI5 as shown in FIG. 2a. Thus, the DPA attacker, when finding this pattern in a power trace, knows that the SP address calculation for SP5 has been found. In addition, the attacker would also know that the information in the power trace for the time slot following the end of the eight shifts would contain the corresponding 4-bit output target. This information allows for the alignment of the power traces for statistical averaging which provides information regarding the 6-bit key. One skilled in the art will appreciate that power traces are noisy, thus finding instruction signatures and other patterns may not guarantee the success of a DPA attack. However, the instruction signatures and other patterns are available in the prior art for an attacker to use. By destroying these instruction signatures and time patterns, the success of a DPA attack is even more unlikely.
FIG. 2b shows the time line with randomized accessing order for the eight SP boxes. As an illustration in FIG. 2b, the processing order of SP1 and SP3 has been swapped; similarly for the SP4 and SP6. In this case, it is obvious that a DPA attacker will have to identify these shifting instruction signatures in order to align power traces by re-shuffling the SP box accessing order. After alignment for a given SP box, statistical averaging and other analysis of these power traces can be performed. Thus, the DPA attacker can ultimately align the power traces to determine the 6-bit key.